sys/kern/sysv_shm.c

   1 /*      $NetBSD: sysv_shm.c,v 1.23 1994/07/04 23:25:12 glass Exp $      */
   2 /*-
   3  * Copyright (c) 1994 Adam Glass and Charles Hannum.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *      This product includes software developed by Adam Glass and Charles
  16  *      Hannum.
  17  * 4. The names of the authors may not be used to endorse or promote products
  18  *    derived from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
  21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  23  * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  30  */
  31 /*-
  32  * Copyright (c) 2003-2005 McAfee, Inc.
  33  * All rights reserved.
  34  *
  35  * This software was developed for the FreeBSD Project in part by McAfee
  36  * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR
  37  * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research
  38  * program.
  39  *
  40  * Redistribution and use in source and binary forms, with or without
  41  * modification, are permitted provided that the following conditions
  42  * are met:
  43  * 1. Redistributions of source code must retain the above copyright
  44  *    notice, this list of conditions and the following disclaimer.
  45  * 2. Redistributions in binary form must reproduce the above copyright
  46  *    notice, this list of conditions and the following disclaimer in the
  47  *    documentation and/or other materials provided with the distribution.
  48  *
  49  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  59  * SUCH DAMAGE.
  60  */
  61
  62 #include <sys/cdefs.h>
  63 __FBSDID("$FreeBSD$");
  64
  65 #include "opt_compat.h"
  66 #include "opt_sysvipc.h"
  67 #include "opt_mac.h"
  68
  69 #include <sys/param.h>
  70 #include <sys/systm.h>
  71 #include <sys/kernel.h>
  72 #include <sys/lock.h>
  73 #include <sys/sysctl.h>
  74 #include <sys/shm.h>
  75 #include <sys/proc.h>
  76 #include <sys/malloc.h>
  77 #include <sys/mman.h>
  78 #include <sys/module.h>
  79 #include <sys/mutex.h>
  80 #include <sys/resourcevar.h>
  81 #include <sys/stat.h>
  82 #include <sys/syscall.h>
  83 #include <sys/syscallsubr.h>
  84 #include <sys/sysent.h>
  85 #include <sys/sysproto.h>
  86 #include <sys/jail.h>
  87
  88 #include <security/mac/mac_framework.h>
  89
  90 #include <vm/vm.h>
  91 #include <vm/vm_param.h>
  92 #include <vm/pmap.h>
  93 #include <vm/vm_object.h>
  94 #include <vm/vm_map.h>
  95 #include <vm/vm_page.h>
  96 #include <vm/vm_pager.h>
  97
  98 static MALLOC_DEFINE(M_SHM, "shm", "SVID compatible shared memory segments");
  99
 100 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 101 struct oshmctl_args;
 102 static int oshmctl(struct thread *td, struct oshmctl_args *uap);
 103 #endif
 104
 105 static int shmget_allocate_segment(struct thread *td,
 106     struct shmget_args *uap, int mode);
 107 static int shmget_existing(struct thread *td, struct shmget_args *uap,
 108     int mode, int segnum);
 109
 110 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 111 /* XXX casting to (sy_call_t *) is bogus, as usual. */
 112 static sy_call_t *shmcalls[] = {
 113         (sy_call_t *)shmat, (sy_call_t *)oshmctl,
 114         (sy_call_t *)shmdt, (sy_call_t *)shmget,
 115         (sy_call_t *)shmctl
 116 };
 117 #endif
 118
 119 #define SHMSEG_FREE             0x0200
 120 #define SHMSEG_REMOVED          0x0400
 121 #define SHMSEG_ALLOCATED        0x0800
 122 #define SHMSEG_WANTED           0x1000
 123
 124 static int shm_last_free, shm_nused, shm_committed, shmalloced;
 125 static struct shmid_kernel      *shmsegs;
 126
 127 struct shmmap_state {
 128         vm_offset_t va;
 129         int shmid;
 130 };
 131
 132 static void shm_deallocate_segment(struct shmid_kernel *);
 133 static int shm_find_segment_by_key(key_t);
 134 static struct shmid_kernel *shm_find_segment_by_shmid(int);
 135 static struct shmid_kernel *shm_find_segment_by_shmidx(int);
 136 static int shm_delete_mapping(struct vmspace *vm, struct shmmap_state *);
 137 static void shmrealloc(void);
 138 static void shminit(void);
 139 static int sysvshm_modload(struct module *, int, void *);
 140 static int shmunload(void);
 141 static void shmexit_myhook(struct vmspace *vm);
 142 static void shmfork_myhook(struct proc *p1, struct proc *p2);
 143 static int sysctl_shmsegs(SYSCTL_HANDLER_ARGS);
 144
 145 /*
 146  * Tuneable values.
 147  */
 148 #ifndef SHMMAXPGS
 149 #define SHMMAXPGS       8192    /* Note: sysv shared memory is swap backed. */
 150 #endif
 151 #ifndef SHMMAX
 152 #define SHMMAX  (SHMMAXPGS*PAGE_SIZE)
 153 #endif
 154 #ifndef SHMMIN
 155 #define SHMMIN  1
 156 #endif
 157 #ifndef SHMMNI
 158 #define SHMMNI  192
 159 #endif
 160 #ifndef SHMSEG
 161 #define SHMSEG  128
 162 #endif
 163 #ifndef SHMALL
 164 #define SHMALL  (SHMMAXPGS)
 165 #endif
 166
 167 struct  shminfo shminfo = {
 168         SHMMAX,
 169         SHMMIN,
 170         SHMMNI,
 171         SHMSEG,
 172         SHMALL
 173 };
 174
 175 static int shm_use_phys;
 176 static int shm_allow_removed;
 177
 178 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmax, CTLFLAG_RW, &shminfo.shmmax, 0,
 179     "Maximum shared memory segment size");
 180 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmin, CTLFLAG_RW, &shminfo.shmmin, 0,
 181     "Minimum shared memory segment size");
 182 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmni, CTLFLAG_RDTUN, &shminfo.shmmni, 0,
 183     "Number of shared memory identifiers");
 184 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmseg, CTLFLAG_RDTUN, &shminfo.shmseg, 0,
 185     "Number of segments per process");
 186 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmall, CTLFLAG_RW, &shminfo.shmall, 0,
 187     "Maximum number of pages available for shared memory");
 188 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_use_phys, CTLFLAG_RW,
 189     &shm_use_phys, 0, "Enable/Disable locking of shared memory pages in core");
 190 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_allow_removed, CTLFLAG_RW,
 191     &shm_allow_removed, 0,
 192     "Enable/Disable attachment to attached segments marked for removal");
 193 SYSCTL_PROC(_kern_ipc, OID_AUTO, shmsegs, CTLFLAG_RD,
 194     NULL, 0, sysctl_shmsegs, "",
 195     "Current number of shared memory segments allocated");
 196
 197 static int
 198 shm_find_segment_by_key(key)
 199         key_t key;
 200 {
 201         int i;
 202
 203         for (i = 0; i < shmalloced; i++)
 204                 if ((shmsegs[i].u.shm_perm.mode & SHMSEG_ALLOCATED) &&
 205                     shmsegs[i].u.shm_perm.key == key)
 206                         return (i);
 207         return (-1);
 208 }
 209
 210 static struct shmid_kernel *
 211 shm_find_segment_by_shmid(int shmid)
 212 {
 213         int segnum;
 214         struct shmid_kernel *shmseg;
 215
 216         segnum = IPCID_TO_IX(shmid);
 217         if (segnum < 0 || segnum >= shmalloced)
 218                 return (NULL);
 219         shmseg = &shmsegs[segnum];
 220         if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 ||
 221             (!shm_allow_removed &&
 222              (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0) ||
 223             shmseg->u.shm_perm.seq != IPCID_TO_SEQ(shmid))
 224                 return (NULL);
 225         return (shmseg);
 226 }
 227
 228 static struct shmid_kernel *
 229 shm_find_segment_by_shmidx(int segnum)
 230 {
 231         struct shmid_kernel *shmseg;
 232
 233         if (segnum < 0 || segnum >= shmalloced)
 234                 return (NULL);
 235         shmseg = &shmsegs[segnum];
 236         if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 ||
 237             (!shm_allow_removed &&
 238              (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0))
 239                 return (NULL);
 240         return (shmseg);
 241 }
 242
 243 static void
 244 shm_deallocate_segment(shmseg)
 245         struct shmid_kernel *shmseg;
 246 {
 247         size_t size;
 248
 249         GIANT_REQUIRED;
 250
 251         vm_object_deallocate(shmseg->u.shm_internal);
 252         shmseg->u.shm_internal = NULL;
 253         size = round_page(shmseg->u.shm_segsz);
 254         shm_committed -= btoc(size);
 255         shm_nused--;
 256         shmseg->u.shm_perm.mode = SHMSEG_FREE;
 257 #ifdef MAC
 258         mac_sysvshm_cleanup(shmseg);
 259 #endif
 260 }
 261
 262 static int
 263 shm_delete_mapping(struct vmspace *vm, struct shmmap_state *shmmap_s)
 264 {
 265         struct shmid_kernel *shmseg;
 266         int segnum, result;
 267         size_t size;
 268
 269         GIANT_REQUIRED;
 270
 271         segnum = IPCID_TO_IX(shmmap_s->shmid);
 272         shmseg = &shmsegs[segnum];
 273         size = round_page(shmseg->u.shm_segsz);
 274         result = vm_map_remove(&vm->vm_map, shmmap_s->va, shmmap_s->va + size);
 275         if (result != KERN_SUCCESS)
 276                 return (EINVAL);
 277         shmmap_s->shmid = -1;
 278         shmseg->u.shm_dtime = time_second;
 279         if ((--shmseg->u.shm_nattch <= 0) &&
 280             (shmseg->u.shm_perm.mode & SHMSEG_REMOVED)) {
 281                 shm_deallocate_segment(shmseg);
 282                 shm_last_free = segnum;
 283         }
 284         return (0);
 285 }
 286
 287 #ifndef _SYS_SYSPROTO_H_
 288 struct shmdt_args {
 289         const void *shmaddr;
 290 };
 291 #endif
 292 int
 293 shmdt(td, uap)
 294         struct thread *td;
 295         struct shmdt_args *uap;
 296 {
 297         struct proc *p = td->td_proc;
 298         struct shmmap_state *shmmap_s;
 299 #ifdef MAC
 300         struct shmid_kernel *shmsegptr;
 301 #endif
 302         int i;
 303         int error = 0;
 304
 305         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 306                 return (ENOSYS);
 307         mtx_lock(&Giant);
 308         shmmap_s = p->p_vmspace->vm_shm;
 309         if (shmmap_s == NULL) {
 310                 error = EINVAL;
 311                 goto done2;
 312         }
 313         for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) {
 314                 if (shmmap_s->shmid != -1 &&
 315                     shmmap_s->va == (vm_offset_t)uap->shmaddr) {
 316                         break;
 317                 }
 318         }
 319         if (i == shminfo.shmseg) {
 320                 error = EINVAL;
 321                 goto done2;
 322         }
 323 #ifdef MAC
 324         shmsegptr = &shmsegs[IPCID_TO_IX(shmmap_s->shmid)];
 325         error = mac_sysvshm_check_shmdt(td->td_ucred, shmsegptr);
 326         if (error != 0)
 327                 goto done2;
 328 #endif
 329         error = shm_delete_mapping(p->p_vmspace, shmmap_s);
 330 done2:
 331         mtx_unlock(&Giant);
 332         return (error);
 333 }
 334
 335 #ifndef _SYS_SYSPROTO_H_
 336 struct shmat_args {
 337         int shmid;
 338         const void *shmaddr;
 339         int shmflg;
 340 };
 341 #endif
 342 int
 343 kern_shmat(td, shmid, shmaddr, shmflg)
 344         struct thread *td;
 345         int shmid;
 346         const void *shmaddr;
 347         int shmflg;
 348 {
 349         struct proc *p = td->td_proc;
 350         int i, flags;
 351         struct shmid_kernel *shmseg;
 352         struct shmmap_state *shmmap_s = NULL;
 353         vm_offset_t attach_va;
 354         vm_prot_t prot;
 355         vm_size_t size;
 356         int rv;
 357         int error = 0;
 358
 359         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 360                 return (ENOSYS);
 361         mtx_lock(&Giant);
 362         shmmap_s = p->p_vmspace->vm_shm;
 363         if (shmmap_s == NULL) {
 364                 size = shminfo.shmseg * sizeof(struct shmmap_state);
 365                 shmmap_s = malloc(size, M_SHM, M_WAITOK);
 366                 for (i = 0; i < shminfo.shmseg; i++)
 367                         shmmap_s[i].shmid = -1;
 368                 p->p_vmspace->vm_shm = shmmap_s;
 369         }
 370         shmseg = shm_find_segment_by_shmid(shmid);
 371         if (shmseg == NULL) {
 372                 error = EINVAL;
 373                 goto done2;
 374         }
 375         error = ipcperm(td, &shmseg->u.shm_perm,
 376             (shmflg & SHM_RDONLY) ? IPC_R : IPC_R|IPC_W);
 377         if (error)
 378                 goto done2;
 379 #ifdef MAC
 380         error = mac_sysvshm_check_shmat(td->td_ucred, shmseg, shmflg);
 381         if (error != 0)
 382                 goto done2;
 383 #endif
 384         for (i = 0; i < shminfo.shmseg; i++) {
 385                 if (shmmap_s->shmid == -1)
 386                         break;
 387                 shmmap_s++;
 388         }
 389         if (i >= shminfo.shmseg) {
 390                 error = EMFILE;
 391                 goto done2;
 392         }
 393         size = round_page(shmseg->u.shm_segsz);
 394 #ifdef VM_PROT_READ_IS_EXEC
 395         prot = VM_PROT_READ | VM_PROT_EXECUTE;
 396 #else
 397         prot = VM_PROT_READ;
 398 #endif
 399         if ((shmflg & SHM_RDONLY) == 0)
 400                 prot |= VM_PROT_WRITE;
 401         flags = MAP_ANON | MAP_SHARED;
 402         if (shmaddr) {
 403                 flags |= MAP_FIXED;
 404                 if (shmflg & SHM_RND) {
 405                         attach_va = (vm_offset_t)shmaddr & ~(SHMLBA-1);
 406                 } else if (((vm_offset_t)shmaddr & (SHMLBA-1)) == 0) {
 407                         attach_va = (vm_offset_t)shmaddr;
 408                 } else {
 409                         error = EINVAL;
 410                         goto done2;
 411                 }
 412         } else {
 413                 /*
 414                  * This is just a hint to vm_map_find() about where to
 415                  * put it.
 416                  */
 417                 PROC_LOCK(p);
 418                 attach_va = round_page((vm_offset_t)p->p_vmspace->vm_daddr +
 419                     lim_max(p, RLIMIT_DATA));
 420                 PROC_UNLOCK(p);
 421         }
 422
 423         vm_object_reference(shmseg->u.shm_internal);
 424         rv = vm_map_find(&p->p_vmspace->vm_map, shmseg->u.shm_internal,
 425                 0, &attach_va, size, (flags & MAP_FIXED)?0:1, prot, prot, 0);
 426         if (rv != KERN_SUCCESS) {
 427                 vm_object_deallocate(shmseg->u.shm_internal);
 428                 error = ENOMEM;
 429                 goto done2;
 430         }
 431         vm_map_inherit(&p->p_vmspace->vm_map,
 432                 attach_va, attach_va + size, VM_INHERIT_SHARE);
 433
 434         shmmap_s->va = attach_va;
 435         shmmap_s->shmid = shmid;
 436         shmseg->u.shm_lpid = p->p_pid;
 437         shmseg->u.shm_atime = time_second;
 438         shmseg->u.shm_nattch++;
 439         td->td_retval[0] = attach_va;
 440 done2:
 441         mtx_unlock(&Giant);
 442         return (error);
 443 }
 444
 445 int
 446 shmat(td, uap)
 447         struct thread *td;
 448         struct shmat_args *uap;
 449 {
 450         return kern_shmat(td, uap->shmid, uap->shmaddr, uap->shmflg);
 451 }
 452
 453 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 454 struct oshmid_ds {
 455         struct  ipc_perm shm_perm;      /* operation perms */
 456         int     shm_segsz;              /* size of segment (bytes) */
 457         u_short shm_cpid;               /* pid, creator */
 458         u_short shm_lpid;               /* pid, last operation */
 459         short   shm_nattch;             /* no. of current attaches */
 460         time_t  shm_atime;              /* last attach time */
 461         time_t  shm_dtime;              /* last detach time */
 462         time_t  shm_ctime;              /* last change time */
 463         void    *shm_handle;            /* internal handle for shm segment */
 464 };
 465
 466 struct oshmctl_args {
 467         int shmid;
 468         int cmd;
 469         struct oshmid_ds *ubuf;
 470 };
 471 static int
 472 oshmctl(td, uap)
 473         struct thread *td;
 474         struct oshmctl_args *uap;
 475 {
 476 #ifdef COMPAT_43
 477         int error = 0;
 478         struct shmid_kernel *shmseg;
 479         struct oshmid_ds outbuf;
 480
 481         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 482                 return (ENOSYS);
 483         mtx_lock(&Giant);
 484         shmseg = shm_find_segment_by_shmid(uap->shmid);
 485         if (shmseg == NULL) {
 486                 error = EINVAL;
 487                 goto done2;
 488         }
 489         switch (uap->cmd) {
 490         case IPC_STAT:
 491                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_R);
 492                 if (error)
 493                         goto done2;
 494 #ifdef MAC
 495                 error = mac_sysvshm_check_shmctl(td->td_ucred, shmseg, uap->cmd);
 496                 if (error != 0)
 497                         goto done2;
 498 #endif
 499                 outbuf.shm_perm = shmseg->u.shm_perm;
 500                 outbuf.shm_segsz = shmseg->u.shm_segsz;
 501                 outbuf.shm_cpid = shmseg->u.shm_cpid;
 502                 outbuf.shm_lpid = shmseg->u.shm_lpid;
 503                 outbuf.shm_nattch = shmseg->u.shm_nattch;
 504                 outbuf.shm_atime = shmseg->u.shm_atime;
 505                 outbuf.shm_dtime = shmseg->u.shm_dtime;
 506                 outbuf.shm_ctime = shmseg->u.shm_ctime;
 507                 outbuf.shm_handle = shmseg->u.shm_internal;
 508                 error = copyout(&outbuf, uap->ubuf, sizeof(outbuf));
 509                 if (error)
 510                         goto done2;
 511                 break;
 512         default:
 513                 error = shmctl(td, (struct shmctl_args *)uap);
 514                 break;
 515         }
 516 done2:
 517         mtx_unlock(&Giant);
 518         return (error);
 519 #else
 520         return (EINVAL);
 521 #endif
 522 }
 523 #endif
 524
 525 #ifndef _SYS_SYSPROTO_H_
 526 struct shmctl_args {
 527         int shmid;
 528         int cmd;
 529         struct shmid_ds *buf;
 530 };
 531 #endif
 532 int
 533 kern_shmctl(td, shmid, cmd, buf, bufsz)
 534         struct thread *td;
 535         int shmid;
 536         int cmd;
 537         void *buf;
 538         size_t *bufsz;
 539 {
 540         int error = 0;
 541         struct shmid_kernel *shmseg;
 542
 543         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 544                 return (ENOSYS);
 545
 546         mtx_lock(&Giant);
 547         switch (cmd) {
 548         /*
 549          * It is possible that kern_shmctl is being called from the Linux ABI
 550          * layer, in which case, we will need to implement IPC_INFO.  It should
 551          * be noted that other shmctl calls will be funneled through here for
 552          * Linix binaries as well.
 553          *
 554          * NB: The Linux ABI layer will convert this data to structure(s) more
 555          * consistent with the Linux ABI.
 556          */
 557         case IPC_INFO:
 558                 memcpy(buf, &shminfo, sizeof(shminfo));
 559                 if (bufsz)
 560                         *bufsz = sizeof(shminfo);
 561                 td->td_retval[0] = shmalloced;
 562                 goto done2;
 563         case SHM_INFO: {
 564                 struct shm_info shm_info;
 565                 shm_info.used_ids = shm_nused;
 566                 shm_info.shm_rss = 0;   /*XXX where to get from ? */
 567                 shm_info.shm_tot = 0;   /*XXX where to get from ? */
 568                 shm_info.shm_swp = 0;   /*XXX where to get from ? */
 569                 shm_info.swap_attempts = 0;     /*XXX where to get from ? */
 570                 shm_info.swap_successes = 0;    /*XXX where to get from ? */
 571                 memcpy(buf, &shm_info, sizeof(shm_info));
 572                 if (bufsz)
 573                         *bufsz = sizeof(shm_info);
 574                 td->td_retval[0] = shmalloced;
 575                 goto done2;
 576         }
 577         }
 578         if (cmd == SHM_STAT)
 579                 shmseg = shm_find_segment_by_shmidx(shmid);
 580         else
 581                 shmseg = shm_find_segment_by_shmid(shmid);
 582         if (shmseg == NULL) {
 583                 error = EINVAL;
 584                 goto done2;
 585         }
 586 #ifdef MAC
 587         error = mac_sysvshm_check_shmctl(td->td_ucred, shmseg, cmd);
 588         if (error != 0)
 589                 goto done2;
 590 #endif
 591         switch (cmd) {
 592         case SHM_STAT:
 593         case IPC_STAT:
 594                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_R);
 595                 if (error)
 596                         goto done2;
 597                 memcpy(buf, &shmseg->u, sizeof(struct shmid_ds));
 598                 if (bufsz)
 599                         *bufsz = sizeof(struct shmid_ds);
 600                 if (cmd == SHM_STAT)
 601                         td->td_retval[0] = IXSEQ_TO_IPCID(shmid, shmseg->u.shm_perm);
 602                 break;
 603         case IPC_SET: {
 604                 struct shmid_ds *shmid;
 605
 606                 shmid = (struct shmid_ds *)buf;
 607                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_M);
 608                 if (error)
 609                         goto done2;
 610                 shmseg->u.shm_perm.uid = shmid->shm_perm.uid;
 611                 shmseg->u.shm_perm.gid = shmid->shm_perm.gid;
 612                 shmseg->u.shm_perm.mode =
 613                     (shmseg->u.shm_perm.mode & ~ACCESSPERMS) |
 614                     (shmid->shm_perm.mode & ACCESSPERMS);
 615                 shmseg->u.shm_ctime = time_second;
 616                 break;
 617         }
 618         case IPC_RMID:
 619                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_M);
 620                 if (error)
 621                         goto done2;
 622                 shmseg->u.shm_perm.key = IPC_PRIVATE;
 623                 shmseg->u.shm_perm.mode |= SHMSEG_REMOVED;
 624                 if (shmseg->u.shm_nattch <= 0) {
 625                         shm_deallocate_segment(shmseg);
 626                         shm_last_free = IPCID_TO_IX(shmid);
 627                 }
 628                 break;
 629 #if 0
 630         case SHM_LOCK:
 631         case SHM_UNLOCK:
 632 #endif
 633         default:
 634                 error = EINVAL;
 635                 break;
 636         }
 637 done2:
 638         mtx_unlock(&Giant);
 639         return (error);
 640 }
 641
 642 int
 643 shmctl(td, uap)
 644         struct thread *td;
 645         struct shmctl_args *uap;
 646 {
 647         int error = 0;
 648         struct shmid_ds buf;
 649         size_t bufsz;
 650
 651         /*
 652          * The only reason IPC_INFO, SHM_INFO, SHM_STAT exists is to support
 653          * Linux binaries.  If we see the call come through the FreeBSD ABI,
 654          * return an error back to the user since we do not to support this.
 655          */
 656         if (uap->cmd == IPC_INFO || uap->cmd == SHM_INFO ||
 657             uap->cmd == SHM_STAT)
 658                 return (EINVAL);
 659
 660         /* IPC_SET needs to copyin the buffer before calling kern_shmctl */
 661         if (uap->cmd == IPC_SET) {
 662                 if ((error = copyin(uap->buf, &buf, sizeof(struct shmid_ds))))
 663                         goto done;
 664         }
 665
 666         error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz);
 667         if (error)
 668                 goto done;
 669
 670         /* Cases in which we need to copyout */
 671         switch (uap->cmd) {
 672         case IPC_STAT:
 673                 error = copyout(&buf, uap->buf, bufsz);
 674                 break;
 675         }
 676
 677 done:
 678         if (error) {
 679                 /* Invalidate the return value */
 680                 td->td_retval[0] = -1;
 681         }
 682         return (error);
 683 }
 684
 685
 686 #ifndef _SYS_SYSPROTO_H_
 687 struct shmget_args {
 688         key_t key;
 689         size_t size;
 690         int shmflg;
 691 };
 692 #endif
 693 static int
 694 shmget_existing(td, uap, mode, segnum)
 695         struct thread *td;
 696         struct shmget_args *uap;
 697         int mode;
 698         int segnum;
 699 {
 700         struct shmid_kernel *shmseg;
 701         int error;
 702
 703         shmseg = &shmsegs[segnum];
 704         if (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) {
 705                 /*
 706                  * This segment is in the process of being allocated.  Wait
 707                  * until it's done, and look the key up again (in case the
 708                  * allocation failed or it was freed).
 709                  */
 710                 shmseg->u.shm_perm.mode |= SHMSEG_WANTED;
 711                 error = tsleep(shmseg, PLOCK | PCATCH, "shmget", 0);
 712                 if (error)
 713                         return (error);
 714                 return (EAGAIN);
 715         }
 716         if ((uap->shmflg & (IPC_CREAT | IPC_EXCL)) == (IPC_CREAT | IPC_EXCL))
 717                 return (EEXIST);
 718 #ifdef MAC
 719         error = mac_sysvshm_check_shmget(td->td_ucred, shmseg, uap->shmflg);
 720         if (error != 0)
 721                 return (error);
 722 #endif
 723         if (uap->size && uap->size > shmseg->u.shm_segsz)
 724                 return (EINVAL);
 725         td->td_retval[0] = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
 726         return (0);
 727 }
 728
 729 static int
 730 shmget_allocate_segment(td, uap, mode)
 731         struct thread *td;
 732         struct shmget_args *uap;
 733         int mode;
 734 {
 735         int i, segnum, shmid, size;
 736         struct ucred *cred = td->td_ucred;
 737         struct shmid_kernel *shmseg;
 738         vm_object_t shm_object;
 739
 740         GIANT_REQUIRED;
 741
 742         if (uap->size < shminfo.shmmin || uap->size > shminfo.shmmax)
 743                 return (EINVAL);
 744         if (shm_nused >= shminfo.shmmni) /* Any shmids left? */
 745                 return (ENOSPC);
 746         size = round_page(uap->size);
 747         if (shm_committed + btoc(size) > shminfo.shmall)
 748                 return (ENOMEM);
 749         if (shm_last_free < 0) {
 750                 shmrealloc();   /* Maybe expand the shmsegs[] array. */
 751                 for (i = 0; i < shmalloced; i++)
 752                         if (shmsegs[i].u.shm_perm.mode & SHMSEG_FREE)
 753                                 break;
 754                 if (i == shmalloced)
 755                         return (ENOSPC);
 756                 segnum = i;
 757         } else  {
 758                 segnum = shm_last_free;
 759                 shm_last_free = -1;
 760         }
 761         shmseg = &shmsegs[segnum];
 762         /*
 763          * In case we sleep in malloc(), mark the segment present but deleted
 764          * so that noone else tries to create the same key.
 765          */
 766         shmseg->u.shm_perm.mode = SHMSEG_ALLOCATED | SHMSEG_REMOVED;
 767         shmseg->u.shm_perm.key = uap->key;
 768         shmseg->u.shm_perm.seq = (shmseg->u.shm_perm.seq + 1) & 0x7fff;
 769         shmid = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
 770
 771         /*
 772          * We make sure that we have allocated a pager before we need
 773          * to.
 774          */
 775         if (shm_use_phys) {
 776                 shm_object =
 777                     vm_pager_allocate(OBJT_PHYS, 0, size, VM_PROT_DEFAULT, 0);
 778         } else {
 779                 shm_object =
 780                     vm_pager_allocate(OBJT_SWAP, 0, size, VM_PROT_DEFAULT, 0);
 781         }
 782         VM_OBJECT_LOCK(shm_object);
 783         vm_object_clear_flag(shm_object, OBJ_ONEMAPPING);
 784         vm_object_set_flag(shm_object, OBJ_NOSPLIT);
 785         VM_OBJECT_UNLOCK(shm_object);
 786
 787         shmseg->u.shm_internal = shm_object;
 788         shmseg->u.shm_perm.cuid = shmseg->u.shm_perm.uid = cred->cr_uid;
 789         shmseg->u.shm_perm.cgid = shmseg->u.shm_perm.gid = cred->cr_gid;
 790         shmseg->u.shm_perm.mode = (shmseg->u.shm_perm.mode & SHMSEG_WANTED) |
 791             (mode & ACCESSPERMS) | SHMSEG_ALLOCATED;
 792         shmseg->u.shm_segsz = uap->size;
 793         shmseg->u.shm_cpid = td->td_proc->p_pid;
 794         shmseg->u.shm_lpid = shmseg->u.shm_nattch = 0;
 795         shmseg->u.shm_atime = shmseg->u.shm_dtime = 0;
 796 #ifdef MAC
 797         mac_sysvshm_create(cred, shmseg);
 798 #endif
 799         shmseg->u.shm_ctime = time_second;
 800         shm_committed += btoc(size);
 801         shm_nused++;
 802         if (shmseg->u.shm_perm.mode & SHMSEG_WANTED) {
 803                 /*
 804                  * Somebody else wanted this key while we were asleep.  Wake
 805                  * them up now.
 806                  */
 807                 shmseg->u.shm_perm.mode &= ~SHMSEG_WANTED;
 808                 wakeup(shmseg);
 809         }
 810         td->td_retval[0] = shmid;
 811         return (0);
 812 }
 813
 814 int
 815 shmget(td, uap)
 816         struct thread *td;
 817         struct shmget_args *uap;
 818 {
 819         int segnum, mode;
 820         int error;
 821
 822         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 823                 return (ENOSYS);
 824         mtx_lock(&Giant);
 825         mode = uap->shmflg & ACCESSPERMS;
 826         if (uap->key != IPC_PRIVATE) {
 827         again:
 828                 segnum = shm_find_segment_by_key(uap->key);
 829                 if (segnum >= 0) {
 830                         error = shmget_existing(td, uap, mode, segnum);
 831                         if (error == EAGAIN)
 832                                 goto again;
 833                         goto done2;
 834                 }
 835                 if ((uap->shmflg & IPC_CREAT) == 0) {
 836                         error = ENOENT;
 837                         goto done2;
 838                 }
 839         }
 840         error = shmget_allocate_segment(td, uap, mode);
 841 done2:
 842         mtx_unlock(&Giant);
 843         return (error);
 844 }
 845
 846 int
 847 shmsys(td, uap)
 848         struct thread *td;
 849         /* XXX actually varargs. */
 850         struct shmsys_args /* {
 851                 int     which;
 852                 int     a2;
 853                 int     a3;
 854                 int     a4;
 855         } */ *uap;
 856 {
 857 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 858         int error;
 859
 860         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 861                 return (ENOSYS);
 862         if (uap->which < 0 ||
 863             uap->which >= sizeof(shmcalls)/sizeof(shmcalls[0]))
 864                 return (EINVAL);
 865         mtx_lock(&Giant);
 866         error = (*shmcalls[uap->which])(td, &uap->a2);
 867         mtx_unlock(&Giant);
 868         return (error);
 869 #else
 870         return (nosys(td, NULL));
 871 #endif
 872 }
 873
 874 static void
 875 shmfork_myhook(p1, p2)
 876         struct proc *p1, *p2;
 877 {
 878         struct shmmap_state *shmmap_s;
 879         size_t size;
 880         int i;
 881
 882         mtx_lock(&Giant);
 883         size = shminfo.shmseg * sizeof(struct shmmap_state);
 884         shmmap_s = malloc(size, M_SHM, M_WAITOK);
 885         bcopy(p1->p_vmspace->vm_shm, shmmap_s, size);
 886         p2->p_vmspace->vm_shm = shmmap_s;
 887         for (i = 0; i < shminfo.shmseg; i++, shmmap_s++)
 888                 if (shmmap_s->shmid != -1)
 889                         shmsegs[IPCID_TO_IX(shmmap_s->shmid)].u.shm_nattch++;
 890         mtx_unlock(&Giant);
 891 }
 892
 893 static void
 894 shmexit_myhook(struct vmspace *vm)
 895 {
 896         struct shmmap_state *base, *shm;
 897         int i;
 898
 899         if ((base = vm->vm_shm) != NULL) {
 900                 vm->vm_shm = NULL;
 901                 mtx_lock(&Giant);
 902                 for (i = 0, shm = base; i < shminfo.shmseg; i++, shm++) {
 903                         if (shm->shmid != -1)
 904                                 shm_delete_mapping(vm, shm);
 905                 }
 906                 mtx_unlock(&Giant);
 907                 free(base, M_SHM);
 908         }
 909 }
 910
 911 static void
 912 shmrealloc(void)
 913 {
 914         int i;
 915         struct shmid_kernel *newsegs;
 916
 917         if (shmalloced >= shminfo.shmmni)
 918                 return;
 919
 920         newsegs = malloc(shminfo.shmmni * sizeof(*newsegs), M_SHM, M_WAITOK);
 921         if (newsegs == NULL)
 922                 return;
 923         for (i = 0; i < shmalloced; i++)
 924                 bcopy(&shmsegs[i], &newsegs[i], sizeof(newsegs[0]));
 925         for (; i < shminfo.shmmni; i++) {
 926                 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
 927                 shmsegs[i].u.shm_perm.seq = 0;
 928 #ifdef MAC
 929                 mac_sysvshm_init(&shmsegs[i]);
 930 #endif
 931         }
 932         free(shmsegs, M_SHM);
 933         shmsegs = newsegs;
 934         shmalloced = shminfo.shmmni;
 935 }
 936
 937 static void
 938 shminit()
 939 {
 940         int i;
 941
 942         TUNABLE_ULONG_FETCH("kern.ipc.shmmaxpgs", &shminfo.shmall);
 943         for (i = PAGE_SIZE; i > 0; i--) {
 944                 shminfo.shmmax = shminfo.shmall * i;
 945                 if (shminfo.shmmax >= shminfo.shmall)
 946                         break;
 947         }
 948         TUNABLE_ULONG_FETCH("kern.ipc.shmmin", &shminfo.shmmin);
 949         TUNABLE_ULONG_FETCH("kern.ipc.shmmni", &shminfo.shmmni);
 950         TUNABLE_ULONG_FETCH("kern.ipc.shmseg", &shminfo.shmseg);
 951         TUNABLE_INT_FETCH("kern.ipc.shm_use_phys", &shm_use_phys);
 952
 953         shmalloced = shminfo.shmmni;
 954         shmsegs = malloc(shmalloced * sizeof(shmsegs[0]), M_SHM, M_WAITOK);
 955         if (shmsegs == NULL)
 956                 panic("cannot allocate initial memory for sysvshm");
 957         for (i = 0; i < shmalloced; i++) {
 958                 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
 959                 shmsegs[i].u.shm_perm.seq = 0;
 960 #ifdef MAC
 961                 mac_sysvshm_init(&shmsegs[i]);
 962 #endif
 963         }
 964         shm_last_free = 0;
 965         shm_nused = 0;
 966         shm_committed = 0;
 967         shmexit_hook = &shmexit_myhook;
 968         shmfork_hook = &shmfork_myhook;
 969 }
 970
 971 static int
 972 shmunload()
 973 {
 974 #ifdef MAC
 975         int i;
 976 #endif
 977
 978         if (shm_nused > 0)
 979                 return (EBUSY);
 980
 981 #ifdef MAC
 982         for (i = 0; i < shmalloced; i++)
 983                 mac_sysvshm_destroy(&shmsegs[i]);
 984 #endif
 985         free(shmsegs, M_SHM);
 986         shmexit_hook = NULL;
 987         shmfork_hook = NULL;
 988         return (0);
 989 }
 990
 991 static int
 992 sysctl_shmsegs(SYSCTL_HANDLER_ARGS)
 993 {
 994
 995         return (SYSCTL_OUT(req, shmsegs, shmalloced * sizeof(shmsegs[0])));
 996 }
 997
 998 static int
 999 sysvshm_modload(struct module *module, int cmd, void *arg)
1000 {
1001         int error = 0;
1002
1003         switch (cmd) {
1004         case MOD_LOAD:
1005                 shminit();
1006                 break;
1007         case MOD_UNLOAD:
1008                 error = shmunload();
1009                 break;
1010         case MOD_SHUTDOWN:
1011                 break;
1012         default:
1013                 error = EINVAL;
1014                 break;
1015         }
1016         return (error);
1017 }
1018
1019 static moduledata_t sysvshm_mod = {
1020         "sysvshm",
1021         &sysvshm_modload,
1022         NULL
1023 };
1024
1025 SYSCALL_MODULE_HELPER(shmsys);
1026 SYSCALL_MODULE_HELPER(shmat);
1027 SYSCALL_MODULE_HELPER(shmctl);
1028 SYSCALL_MODULE_HELPER(shmdt);
1029 SYSCALL_MODULE_HELPER(shmget);
1030
1031 DECLARE_MODULE(sysvshm, sysvshm_mod,
1032         SI_SUB_SYSV_SHM, SI_ORDER_FIRST);
1033 MODULE_VERSION(sysvshm, 1);